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NETWORK XOT'OFMATION DETECTION APPARATUS AND METHOD 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

The present invention relates generally to a 
network system, and more particularly to a network 
6 information detecLion apparatus for and method of 
automatically acquiring network information. 

2. Description of the Related Art 

To connect a computer to a network, one must set 
network information such as router IP (Internet 

10 Protocol) address and DNS ( Domain Name System) IP address 
to the computer . While such information may be set 
manually/ manual setting requires network knowledge and 
time and effort must be expended to investigate network 
information. Erroneous setting of network information 

15 may send the entire network into a tailspin. 

In the presence of a DHCP (Dynamic Host 
Configuration Protocol) server, on the other hand, 
network information can be acquired from the DHCP server. 
To thus allow automatic acquisition of network 

20 information, however, a server must be built that is 
intended to provide network information. 

Japanese Patent Application Unexamined 
Publication No. 200^^-190811 discloses as an example a 
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method of automatically acquiring IP addresses of 
networked devices. According to the prior art method, 
when network information cannot be obtained from DHCP 
server, an effective subnet is determined by analyzing 
5 network traffic (see paragraph Nos. 0018 to 0021) and, 
within the subnet, the default router and the DNS server 
are detected respectively using an ICMP (Internet 
Control Message Protocol) router selection message and 
a SNMP (Simple Network Management Protocol) DNS find 

10 request (paragraph Nos. 0025 to 0027). 

However, the IP configuration automatic 
acquisition method as disclosed in the above publication 
uses the router IP address detection method described 
in RFC1256 as it is and does not consider speeding up 

15 router detection. Besides, some routers do not support 
ICMP Router Selection, occasionally resulting in 
routers not being detected by the prior art method. 
Similarly, the aforementioned prior art method 
does not consider speeding up DNS server detection. 

20 Besides, some DNS servers do not support SNMP's DNS find 
request, occasionally resulting in DNS servers not being 
detected, 

SUMMARY OF THE INVENTION 



It is therefore an object of the present invention 
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to provide a network Information detection apparatus and 
method capable of automatically and rapidly acquiring 
network information without needing any server 
functions for providing network information, 
5 It is another object of the present invention to 

provide a network information detection apparatus and 
method capable of reliably acquiring network 
inf ormati.on . 

According to a first aspect of the present invention, 

10 an IP address of a device connected to a network is 
detected by the following: a search IP address detector 
for detecting at least one search IP address from IP 
addresses which are selected every a predetermined 
number of IP addresses as a unit from possible IP 

15 addresses on the network; an IP address detector for 
detecting an IP address of a target device from the at 
least one search IP address detected; and a controller 
for terminating a network information detection 
operation either when all possible IP addresses on the 

20 network have been selected or when the IP address of the 
target device has been detected. 

According to a second aspect of the present 
invention, an IP address on a network including at least 
a DNS (Domain Name System) server is detected by the 

25 following: a search IP address detector for detecting 
at least one search IP address from possible IP addresses 
on the network; a DNS message communication section for 
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sending a DNS query message to the at least one search 
IP address and receiving a response message to the DNS 
query message; and a DNS server detector for 
discriminating a DNS response message from the response 
5 message to detect an IP address of a DNS server 
originating the DNS response message. 

The search IP address detector may send an ARP 
(Address Resolution Protocol) request at a time to IP 
addresses which are selected every a predetermined 

10 number of IP addresses as a unit from the possible IP 
addresses on the network, and detect the at least one 
search IP address from an ARP response to the ARP request - 

The DNS query message may be a message with 
resetting QR bit of DNS protocol header, which is a 

15 message of at least one type selected from a group of 
standard query, inverse query, server status request and 
update. 

The network information detection apparatus as 
described above further includes an ICMP message 

20 communication section for sending an ICMP echo query 
message to the at least one search IP address and 
receiving an ICMP response message to the ICMP echo query 
message; and a router detector for detecting an IP 
address of a router originating the ICMP response message. 

25 The ICMP response message may be one of an ICMP redirect 
request message and an ICMP time exceed message. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The above and other objects ^ aspects, features and 
advantages of the present invention will become more 
apparent from the following detailed description when 
6 taken in conjunction with the accompanying drawings, in 
which: 

Fig. 1 is a schematic configuration diagram showing 
an example of network including a network information 
detection apparatus according to the present invention; 
10 Fig. 2 is a block configuration diagram showing a 

network information detection apparatus according to a 
first embodiment of the present invention; 

Fig. 3 is a flowchart showing as a whole the 
router/DNS server detection operation of the first 
15 embodiment according to the present invention; 

Fig. 4 is a flowchart showing an example of the 
router feature check operation carried out by a router 
detection section in the first embodiment of the present 
invention; 

20 Fig. 5 Is a flowchart showing an example of the DNS 

server feature check operation carried out by a DNS 
server detection section in the first embodiment of the 
present invention; 

Fig. 6 is a block configuration diagram showing a 

25 network information detection apparatus according to a 
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second embodiment of the present invention; 

Fig. 7 illustrates an IP address format; 

Fig, 8 illustrates an Ethernet packet format; 

Fig. 9 illustrates an IP packet format; 
5 Fig. lOA illustrates an ICMP echo request/response 

packet format; 

Fig, lOB illustrates an ICMP Time Exceed notice 
packet format; 

Fig. IOC illustrates an ICMP redirect packet 
10 format; 

Fig, 11 illustrates an ARP packet format; and 
Fig. 12 illustrates a DNS protocol header format. 



DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Referring to Fig- 1, a plurality of network devices 
15 are connected to a network transmission line 10,. 

including a network information detection apparatus 20, 
a host A 30, a host B 40, a DNS server 50 and a router 
60- The network information detection apparatus 20 
according to the present invention detects the DNS server 
20 50 and/or the router 60 from this subnet. 

As shown in Fig. 2, the network information 
detection apparatus 20 according to the present 
embodiment has a network interface section 21 for 
connection to the network transmission line 10. The 
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network interface section 21 is connected to an ARP 
request transmission section 23, an ARP reply reception 
secLion 24, a router detection section 25, a DNS server 
detection section 2 6 and a network information 
5 transmission section 28, which are used to 

transmit/receive IP and ARP packets as described later- 
The ARP reply reception section 24 is connected as 
described later to the router detection section 25 and 
the DNS server detection section 2 6, whereas the router 

10 detection section 25, the DNS server detection section 
26 and the network information transmission section 28 
are respectively connected to a network information 
setting section 27, The overall operation of the 
network information detection apparatus 20 is 

16 controlled by a control section 22, 

Under the control of the control section 22, the 
ARP request transmission section 2 3 repeatedly 
transmits ARF request packets to a predetermined number 
of IP addresses within the subnet, which will be 

20 described in detail later. It is to be noted that the 
IP address format and the ARP request packet format are 
illustrated respectively in Figs. 7 and 11- In Fig. 7, 
the subnet mask is a string of values with all bits in 
the network part and the subnet part being set and all 

25 bits in the host part being reset. The subnet refers 
to a logical network capable of communication in the IP 
layer without routing. As for IP addresses in a subnet. 



2004 03/15 14:06 FAX 03 3288 3222 Katsuragi Patent FOLEY & LARDNER 



@016/045 



FQ5-620 8 

network addresses are identical, with only the host parts 
being different from one another. 

The ARP reply reception section 24 receives an ARP 
reply packet from the host A 30, the host B 40, the DNS 
5 server 50 or the router 60 as a reply to the ARP request 
packet transmitted by the ARP request transmission 
section 23 . The source IP address of the ARP reply packet 
is output to the router detection section 25 and the DNS 
server detection section 26, The ARP reply packet 
10 format is shown in Fig. 11. 

Assuming the source IP address, input from the ARP 
reply reception section 24, to be a router detection 
target IP address, the router detection section 25 
detects the router 60 by repeating router feature check 
16 for each of the preset number of router detection target 
IP addresses (details given later) . The IP address of 
the detected router 60 is output to the network 
information setting section 27, 

Assvuning the source IP address, input from the ARP 
20 reply reception section 24, to be a DNS server detection 
target IP address, the DNS server detection section 26 
detects the DNS server 50 by repeating DNS server feature 
check for each of the preset number of DNS server 
detection target IP addresses (details given later) . 
25 The IP address of the detected DNS server 50 is output 
to the network information setting section 27. 

The network information setting section 27 outputs 
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to the network information transmission section 28 at 
least one of the router IP address detected by the router 
detection section 2 5 and the DNS server IP address 
detected by the DNS server detection section 26 so that 
5 the address or addresses can be set to its own apparatus 
or that the address or addresses can be used in other 
network devices. 

The network information transmission section 28 
transmits the router IP address and/or the DNS server 
10 IP address, input from the network information setting 
section 21 , via the network interface section 21 so that 
the address or addresses can be used in other network 
devices . 

A packet flowing over the network transmission line 
15 10 takes the format of a data link layer packet shown 
in Fig- 8 when the LAN is Ethernet (registered trademark, 
IEEE802.3), takes the format shown in Fig. 9 in the case 
of an IP packet and takes the format shown in Fig. 11 
in the case of an ARP packet. 
20 Although being provided with both the router 

detection section 25 and the server detection section 
26/ the network information detection apparatus 20 may 
be provided with only either of the two. 

It is to be noted that while not shown in Fig. 2, 
26 a service detection section may be provided in the 

network information detection apparatus 20 according to 
the present embodiment so as to detect the IP address 
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of a device performing a service or function other than 
the above on the network. 

Network Information Dete cting Operatio n 

A detailed description will be given below of the. 
5 operation of the present embodiment with reference to 

the flowcharts shown in Figs. 3 to 5 and the packet 

formats shown in Figs. 8 to 12. 

Referring to Fig. 3, first, the control section 22 

determines, based on subnet information stored in 
10 advance, whether the ARP request transmission section 

23 has issued an ARP request packet (refer to Fig. 11) 

to all the IP addresses in the subnet (Step S2001) . If 

it is true {YES of step 82001), the operation is 

terminated . 

15 If the ARP request packet has not been issued to 

all the IP addresses in the subnet (No in Step S2001) / 
the ARP request packet will be issued collectively to 
every the preset number of IP addresses in the subnet 
(Step S2002) . More specifically, if we assume that the 

20 subnet mask is 255.255,255.0^ the network address 

192.168.1.0 and the number of IP addresses to which the 
ARP request packet is sent at a time is 10.0^ then the 
ARP request packet is transmitted to IP addresses from 

192.168.1.1 to 192.168.1.100 at the first execution of 
25 Step S2002, to IP addresses from 192.168.1.101 to 

192 . 168 . 1 . 200 at the second execution and to IP addresses 
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from 192.168.1.200 to 192 . 168 . 1 • 254 at the third 
execution . 

The control secLion 22 determines whether one or 
more ARP reply packets (refer to Fig. 11) have been 
5 received as a reply to the ARP request (Step S2003) and 
returns to Step 52001 if there have been no ARP replies 
(No in Step S2003) . 

-When one or more ARP reply packets (refer to Fig. 
11) have been received (Yes in Step S2003) , the control 

10 section 22 determines whether router detection is 
complete (Step S2004) . If router detection is not- 
complete (No in Step S2004), the control section 22 
performs router feature check (Step S2005) . when router 
detection is complete (Yes in Step S2004)/ the control 

15 section 22 skips router feature check and determines 
whether DNS server detection is complete (Step S2006) . 

If DNS server detection is not complete (No in Step 
S2006) , the control section 22 performs DNS server 
feature check (Step S2007) , when DNS server detection 

20 is complete (Yes in Step S2006), the control section 22 
skips DNS server feature check and determines whether 
the router and the DNS server have been detected (Step 
S2008) - 

When the router and the DNS server have been 
25 detected (Yes in Step S2008), the control section 22 
terrainates the processing. If the router and the DNS 
server have not been detected (No in Step 52008), the 
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control section 22 returns to Step S2001 and repeats the 
above operation until the ARP request packet is issued 
to all the IP addresses in the subnet or until the router 
and the DNS server are detected. 
6 It is to be noted that if a service detection section 

is provided, an ARP request packet may be issued at a 
time to the preset number of IP addresses in the subnet, 
thus performing service or function detection to the 
source IP address contained in each ARP reply packet that 
10 is a reply to the ARP request packet issued. 

(1) Router Fe^^ture Check 

In Fig. 4, TP addresses to be searched for routers 
are source IP addresses contained respectively in all 
the ARP reply packets received by the ARP reply reception 

15 section 24. When these router search IP addresses are 
entered (Step 32020), it is determined whether router 
feature check has been performed for all the router 
search IP addresses (Step S2021) - When router feature 
check is complete for all the IP addresses (Yes in Step 

20 S2021) , the router detection section terminates the 
router feature check operation. 

If some router search IP addresses have yet to be 
inspected (No in Step S2021) , an ICMP echo request packet 
(refer to Fig. lOA) , with its TTL (Time to Live) set in 

25 advance to a desired value, is transmitted at a time to 
the preset number of router search IP addresses (Step 
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52022) . Here, TTL is assumed to be 2r that is^ the number 
of router steps through which a packet can pass is assumed 
to bo 2. 

For example, if the router search IP addresses are 
5 from 192.1.68.1.10 to 192,168,1.24 and from 192.168-1-40 
to 192,168,1.51 and if router feature check is conducted 
collectively on ten IP addresses. Step $2022 is executed 
by transmitting an ICMP echo request at a time to IP 
addresses from 192.168.1.10 to 192.168.1.19 at the first 

10 execution, to IP addresses from 192.168.1.20 to 

192.168,1.24 and from 192.168.1.40 to 192.168.1.44 at 
the second execution and to IP addresses from 
192.168.1.45 to 192.168.1.51 at the third execution. 
. After the ICMP echo request packet has been 

15 transmitted collectively, the router detection section 
25 determines whether an ICMF redirect message (refer 
to Fig. IOC) is received within a predetermined time 
period in response to the ICMP echo request packet (Step 

52023) . 

20 If no ICMP redirect message has been received (No 

in Step S2023) the roviter detection section 25 
determines whether an ICMP Time Exceed message (Fig, lOB) 
J'las been received within a predetermined time period in 
response to the ICMP echo request (Step S2024) . If no 

26 ICMP Time Exceed message has been received (No in Step 

52024) , the control of the router detection section 25 
returns to Step S2021 . When the ICMP Time Exceed message 
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has been received within a predetermined time period (Yes 
in Step S2024), the router detection section 25 
terminates the router feciture check operation, 
concluding that the source IP address contained in the 
5 Time Exceed message packet is the router IP address (Step 

52025) . 

When the ICMP redirect message has been received 
(Yes in Step S2023), the router detection section 25 
terminates the router feature check operation, 
10 concluding that the router IP address contained in the 
ICMP redirect message is the router IP address (Step 

52026) - 

Thus, router detection is carried out by ICMP 
redirect and ICMP Time Exceed message received within 
15 a predetermined time period after transmission of ICMP 
echo request packet that is a packet whose TTL is set 
to a given value, ensuring fast router detection. 
Besides, routers always support the ICMP Time Exceed 
message function, allowing reliable router detection. 

20 (2) DNS Server Feature Check 

Referring to Fig. 5, first, IP addresses to be 
searched for DNS server are source IP addresses contained 
respectively in all the ARP reply packets received by 
the ARP reply reception section 24. When these DNS 

25 server search IP addresses are entered (Step S2040) , the 
DNS server detection section 26 determines whether DNS 
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server feature check has been performed for all the DNS 
server search IP addresses (Step S2041) - When DNS 
server feature check is complete for all the IP addresses 
(Yes in Step S2041), the DNS server detection section 
5 2'6 terminates the DNS server feature check operation • 

If some DNS server search IP addresses have yet to 
be inspected (No in Step S2041) , a DNS query (refer to 
Fig, 12), with its QR (Question/Response) bit reset, is 
transmitted at a time to a preset number of DNS server 
• 10 search IP addresses (Step S2042) , This DNS query with 
reset QR bit is a query message such as a standard query 
(OPCODE^O) , inverse query (OPCODE^l)^ server status 
request (OPCOOE-2) or update. 

As for collective transmission, for example, if the 
15 DNS server search IP addresses are from 192-168.1-10 to 
192.168.1.24 and f rom. 192 .1 68 . 1 . 4 0 to 192.168.1,51 and 
if DNS server feature check is conducted collectively 
on ten IP addresses, the DNS query is transmitted at a 
time to IP addresses from 192.168.1.10 to 192.168.1.19 
20 at the first execution;- to IP addresses from 192. 168. 1 .20 
to 192.168.1.24 and from 192.168.1.40 to 192.168.1.44 
at the second execution and to IP addresses from 
192.168.1.45 to 192.168.1.51 at the third execution. 

When the DNS query is transmitted at a time, the 
26 DNS server detection section 26 determines whether a DNS 
response has been received within a predetermined time 
period in response to the DNS query (Step S2043) . If 
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no reply has been received (^3Q in Step S2043) , the control 
of the DNS server detection section 26 returns to Step 
S2041. When a DNS response has been received within a 
predetermined time period in response to the DNS query 
5 {Yes in Step. 2043), the DNS server detection section 26 
terminates the DNS server feature check operation, 
concluding that the source IP address contained in the 
DNS response packet is the DNS server IP address (Step 
S2045) . 

10 Thus, DNS server detection is carried out by 

response received within a predetermined time period 
after transmission of DNS protocol query message, 
ensuring fast router detection- Besides, DNS servers 
always support the response function to respond to a 

15 received query message, allowing reliable DNS server 
detection - 

As shown in Fig. 6, the network information 
detection apparatus 20 according to a second embodiment 
of the present embodiment includes a network interface 

20 201 for connection to the network transmission line 10 
and a send/receive control section 202 for 
transmitting/receiving IP or ARP packets described 
above, and a program-controlled processor 203 
controlling the detection and setting of network 

25 information discussed earlier. 

The program-controlled processor 203 runs router 
and DNS server detection programs and necessary service 
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detection programs read from a program memory 204, 
allowing the network: information detection operation as 
shown in Figs. 3 to 5. Network information thus detected 
is stored in a network information memory 205 and is set 
5 to its own apparatus. Alternatively, network 
information is transmitted for setting of other 
networked devices- Description of the network 
information detection operation, carried out by the 
program-controlled processor 203, will be omitted here 

10 ■ since the operation has been described already with 
reference to Figs. 3 to 5. 

As described above in detail, according to the 
present invention, it is possible to ensure fast IP 
address detection by successively selecting a preset 

15 number of IP addresses from among available IP addresses 
on the network/ detecting search TP addresses from a 
selected set of the preset number of IP addresses, and 
detecting the IP address of an intended target device 
from the detected search IP addresses. 

20 Further, according to the present invention, it is 

possible to ensure fast router detection thanks to router 
detection by ICMP redirect request and ICMP Time Exceed 
message that are replies to ICiXIP echo request. 
Additionally, routers always support the ICMP Time 

25 Exceed message function, allowing reliable router 
detection , 

In addition, according to the present invention. 
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it is possible to ensure fast DNS server detection thanks 
to DNS server detection by response to DNS protocol query 
message. Additionally, DNS servers always support the 
response function to respond to query message^ allowing 
5 reliable DNS server detection. 

Thus, fast and automatic detection of DNS server 
and router IP addresses reduces wait time for users, 
eliminates the manual tasks of entering a DNS 
server/router IP address by users and prevents confusion 

10 in the network or upsurge in load as i\ result of erroneous 
address entry. The. network information detection 
apparatus according to the present invention is 
particularly effective for connecting a network device, 
purchased from a distributor, to the user network and 

15 moving a network device from one network to another. 
While illustrative and presently preferred 
embodiments of the present invention have been described 
in detail herein, it is to be understood that the 
inventive concepts may be otherwise variously embodied 

20 and employed and that the appended claims are intended 
to be construed to include such variations except insofar 
as limited by the prior art. 



